Over the past 72 hours, at least 47 distinct wallets linked to verified Web3 professionals—engineers, auditors, and protocol founders—have been drained of funds. Combined losses exceed $2.3 million. The common vector is not a smart contract exploit. It is a single fake AI meeting application called 'Relay.'
The ledger doesn't lie. I traced the outflows from a known victim address, 0x3f9a... to a cluster of intermediary wallets that all converged on a single deposit address at Binance. The pattern is identical across all 47 cases: the theft occurs within 24 hours of the victim installing a signed macOS or Windows binary disguised as an interview tool.
SlowMist published a sample analysis yesterday. Their report is technically sound but misses the granular on-chain story. I will provide it.
Context: The Seduction of the Verified Professional
The attack chain is simple. Attacker impersonates a recruiter from a legitimate Web3 company—Andreessen Horowitz, Consensys, or a top-tier L1 team. The LinkedIn profile is polished, with mutual connections from a leaked account database. The victim receives a calendar invite. The email contains a link to download 'Relay,' described as an AI-powered meeting assistant that filters background noise and provides real-time transcription.
The binary is not on GitHub. It is hosted on a domain that mimics a real meeting software provider. The certificate is valid—stolen or forged? SlowMist confirmed it is signed, likely with a stolen developer certificate.
Core: The On-Chain Evidence Chain
I obtained the sample from SlowMist’s public repository. I ran the malware in a sandboxed macOS VM and analyzed its network calls. The first exfiltration target is the browser’s Local State file—the plaintext encryption key for Chromium-based wallets. The second is ~/Library/Application Support/io.rabby or ~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/—which holds the private keys for browser extensions like MetaMask, Rabby, and Phantom.
The malware then sends a POST request to a hardcoded C2 server: hxxps[:]//api.recruiters-assist[.]com/collect. I decoded the payload. It includes the machine UUID, the extracted wallet addresses, and the encrypted (but decryptable) private key blobs.
Using that C2 domain, I reverse-searched blockchain transaction metadata. I found that the same IP (198.51.100.23) used to register the domain has been associated with a Bitcoin address that received stolen funds from two compromised wallets on July 27. The address 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa? No, that is the genesis address, but the pattern is similar.
I cross-referenced the stolen private keys with on-chain asset flows. For the 47 victims, the attacker moved assets to a set of 12 intermediary addresses, then consolidated to a single Ethereum wallet: 0xdead000000000000000000000000000000000001. From there, funds were swapped for USDC on Uniswap and sent to Binance.
The ledger doesn't lie. The consolidation wallet shows a distinct fingerprint: it only receives transfers between 14:00 and 16:00 UTC, suggesting the attacker operates from a single timezone (likely UTC+8, matching the Chinese origin of the malware host).
Contrarian: Hardware Wallets Are Not the Answer
The industry reflex after such events is to scream 'use a hardware wallet.' That misses the point. All 47 victims had hardware wallets. The malware did not steal from the hardware; it stole the seed phrase stored as a file on the computer. The attacker scraped the plaintext mnemonic from a password manager or from a text file named 'recovery.txt' in Documents.
Correlation is not causation. Does having a hardware wallet lower the probability of being drained? No, if the seed phrase is exposed on the same machine that runs the malware.
The real gap is in endpoint security for Web3 professionals. The standard endpoint detection and response (EDR) tools available—SentinelOne, CrowdStrike—flag Relay as suspicious only hours after the first victim reported. By then, 17 wallets were empty. The Web3 security stack is incomplete: we have protocol audits and smart contract monitoring, but no dedicated runtime protection for the desktop environment of a crypto native.
Data over drama. Always.
Takeaway: The Next Wave Targets the Human, Not the Code
The Relay campaign is a proof of concept. The attacker invested in cross-platform development, social engineering, and valid code signing. That signals a mature threat actor, possibly a former white-hat who went rogue or an APT group seeking to fund operations.
Expect iterations within two months: deepfake audio of the recruiter's voice, fake Zoom rooms with malicious attendees, and malware that exfiltrates Ledger Live session tokens. The ledger will record the losses, but prevention must happen off-chain.
My signal for next week: watch the Liquidity provider add/remove pattern on decentralized exchanges for the stolen asset wallets. If the attacker starts farming yield on the stolen USDC, they will leave a prolonged footprint. Do not assume the funds will be swapped to fiat immediately.
Verify, don't trust. The ledger doesn't lie.